Most enterprise incident response plans were written before AI tools became mainstream. They cover data breaches, ransomware, and account compromise — but they don't specifically address AI-related incidents: an employee submitting confidential client data to Claude, an Anthropic-side security event, or Claude producing a materially wrong output used in a high-stakes decision.
This guide covers how to build AI incident response capability into your existing IRP, the specific incident types you need to plan for, and the response procedures that work across our 200+ enterprise Claude deployments.
Include AI Governance in Your Security Programme
We review your existing incident response plan, identify AI coverage gaps, and produce an AI-specific IRP annex covering Claude and other enterprise AI tools — in 2 weeks.
Request Free Assessment →Claude-Specific Incident Types and Severity Levels
Before building response procedures, define the incident types you're planning for. Claude-related incidents fall into five categories, each with different response requirements.
Incident Response Phases for AI Incidents
Integrate these phases into your existing IRP structure as an AI-specific annex rather than creating a separate process.
Detection and Triage (0-1 hour)
Incident identified via monitoring, employee self-report, Anthropic notification, or audit review. Assign severity level using the framework above. Engage CISO and relevant data protection contact. If PHI, PCI, or significant PII is involved, engage Legal immediately.
Containment (1-4 hours)
For account-related incidents: suspend the affected account immediately. For AUP violations: document and preserve evidence before taking further action. For Anthropic-side incidents: review what data was in scope based on your usage logs. Preserve all evidence relevant to the incident before taking remediation actions.
Assessment and Notification Decision (4-24 hours)
Determine: (a) what data was involved, (b) what regulatory framework applies, (c) whether the incident constitutes a reportable breach. GDPR breach notification is required within 72 hours of becoming aware if the incident is likely to cause risk to individuals. Document the assessment decision and reasoning regardless of outcome.
Notification (if required)
Notify supervisory authority within 72 hours (GDPR). Notify affected individuals where required. Notify Anthropic via your enterprise contact if you believe an Anthropic-side issue contributed to the incident. Document all notifications with timestamps and recipients.
Recovery and Post-Incident Review
Restore normal operations with any required control enhancements. Conduct a post-incident review within 2 weeks. Document root cause and contributing factors. Update your AUP, training, or technical controls as appropriate. Report lessons learned to your AI governance function.
White Paper: AI Compliance — SOC 2, HIPAA & GDPR
Includes a complete AI incident response template, breach notification assessment framework, and post-incident review checklist for enterprise Claude deployments.
Download Free →Notification Obligations by Regulation
Understanding your notification timelines before an incident occurs is essential. In the heat of an incident, you don't want to be researching regulatory timelines.
GDPR / UK GDPR
Supervisory authority: 72 hours from becoming aware of a breach likely to result in risk to individuals. Notification to the ICO (UK) or relevant EU DPA. Assessment of risk must be documented even for incidents below the notification threshold.
Affected individuals: Without undue delay if the breach is likely to result in high risk to individuals. "High risk" is assessed by reference to the nature of data, number of individuals, and potential consequences.
HIPAA (Healthcare)
Business associates (including you if you're a BA) must notify the covered entity without unreasonable delay and within 60 days. Covered entities must notify individuals within 60 days, and HHS/OCR within 60 days (or annually for breaches affecting fewer than 500 individuals).
US State Breach Notification Laws
Requirements vary by state. Most states require notification to affected individuals within 30-90 days of discovery. Some states (e.g., New York SHIELD Act) have more expansive definitions of personal data and shorter timelines. Maintain a breach notification law matrix for the states where your data subjects reside.
Prevention: Reducing Incident Probability
The best incident response is the one you don't need. The controls that most effectively prevent Claude-related security incidents, in order of impact:
- PII scrubbing at the application layer — automated scrubbing eliminates a large class of accidental prohibited data submission incidents
- Single Sign-On (SSO) — centralised access control dramatically reduces unauthorised access risk and simplifies access revocation
- Usage monitoring and alerting — alert on anomalous usage patterns (unusual volumes, new data categories, new user accounts)
- Clear AUP with regular training — most Claude policy violations are not malicious; they're employees who don't know the rules. Training reduces violations significantly.
- Mandatory use case approval — new use cases reviewed before deployment catch compliance issues before they become incidents
Organisations that implement all five controls typically see zero reportable incidents in the first year of Claude deployment. Those that skip controls and rely only on policy frequently see at least one incident requiring formal assessment within 12 months.
